11.09

Control Activities

Principle 11 - Design General Control Activities over Information Technology

Attribute 11.09 - General control activities may be applied at the entity, system, and business process levels. General control activities include the following:

• Security management - A separate process, addressing all components of internal control, for responding to risks related to information security.
• Logical and physical access - Control activities that restrict access to information technology to authorized users.
• Configuration management - Control activities to develop and maintain the operating and security features of information technology and control changes to their configuration.
• Segregation of duties - Separating control activity responsibilities related to information technology to prevent individuals from controlling all critical stages of a process or overriding automated processes.
• Contingency planning - Control activities that maintain the continuity of operations and rely on information technology, including contingency plans for recovery after a disruption of service.

>>>Navigational Buttons<<<

• Index of Attributes
• Previous Attribute - 11.08
• Next Attribute - 11.10

Jamie's Story

No examples are available to illustrate governance gaps for this attribute.

Election Anomalies

No examples are available to illustrate governance gaps for this attribute.